> CVE-2026-45447

« BACK_TO_HOME
PUBLISHED
2026-06-09 17:17
MODIFIED
2026-06-09 17:17
EPSS (Prob. Exploit)
4.00%
Top 9.5%
DATA SOURCES:
NVD 🔗 2026-06-09 RED HAT 🔗 2026-06-14 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 MSRC 🔗 2026-11-02

> DESCRIPTION

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution. Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

> AFFECTED_PRODUCTS

Red Hat - Red Hat Enterprise Linux 10
Version: 3.5.5
Red Hat - Red Hat Enterprise Linux 9
Version: 3.5.5

> WEAKNESSES

CWE-416

> CWE DETAILED DESCRIPTIONS

CWE-416: Use After Free - The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (...
Red Hat Security Advisory: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...
Red Hat Security Advisory: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.8 Update Services for SAP Solut...
Red Hat Security Advisory: Red Hat Update Infrastructure 5.2 security update
The latest release of Red Hat Update Infrastructure. For more details, see the product documentation.
Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage
A Subscription Management tool for finding and reporting Red Hat product usage
Red Hat Security Advisory: Insights proxy Container Image
Initial GA Release of Red Hat Insights proxy
Red Hat Security Advisory: compat-openssl11 security update
An update for compat-openssl11 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Co...
Red Hat Security Advisory: compat-openssl10 security update
An update for compat-openssl10 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...
Red Hat Security Advisory: compat-openssl10 security update
An update for compat-openssl10 is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product...
Red Hat Security Advisory: compat-openssl11 security update
An update for compat-openssl11 is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Impor...
Red Hat Security Advisory: compat-openssl11 security update
An update for compat-openssl11 is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Impor...
Red Hat Security Advisory: Cost Management Metrics Operator Update
Cost Management Metrics Operator version 4.4.2 release.
Red Hat Security Advisory: compat-openssl11 security update
An update for compat-openssl11 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...
Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.13.10 security update
Red Hat Advanced Cluster Management for Kubernetes v2.13 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated...
Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.9 security update
Red Hat multicluster engine for Kubernetes v2.8 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this upd...
Red Hat Security Advisory: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vul...
Red Hat Security Advisory: Red Hat Update Infrastructure 5.3 Technology Preview security update
A new set of Red Hat Update Infrastructure container images is now available as a Technology Preview in the Red Hat container registry.
Red Hat Security Advisory: OpenShift Container Platform 4.12.97 bug fix and security update
Red Hat OpenShift Container Platform release 4.12.97 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red H...
Red Hat Security Advisory: openssl security, bug fix, and enhancement update
An update for openssl is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION. Red Hat Product Security has rated this update as having a security impact of Important....
Red Hat Security Advisory: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vul...
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.20.1
cert-manager Operator for Red Hat OpenShift 1.20.1
Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.5 release and security update
Red Hat JBoss Web Server 6.2.5 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server. Red Hat Product Security has r...
Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.2 release and security update
Red Hat JBoss Web Server 7.0.2 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server. Red Hat Product Security has r...
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.2
cert-manager Operator for Red Hat OpenShift 1.18.2
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.2
cert-manager Operator for Red Hat OpenShift 1.18.2
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.2
cert-manager Operator for Red Hat OpenShift 1.18.2
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.17.2
cert-manager Operator for Red Hat OpenShift 1.17.2
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.17.2
cert-manager Operator for Red Hat OpenShift 1.17.2
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.17.2
cert-manager Operator for Red Hat OpenShift 1.17.2
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.2
cert-manager Operator for Red Hat OpenShift 1.18.2
Red Hat Security Advisory: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vuln...
Red Hat Security Advisory: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A C...
Red Hat Security Advisory: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A C...
Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (Neuron)
Red Hat AI Base Images 3.5.5 (Neuron) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (Neuron)
Red Hat AI Base Images 3.4.6 (Neuron) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (ROCm 7.14)
Red Hat AI Base Images 3.5.5 (ROCm 7.14) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (Spyre)
Red Hat AI Base Images 3.4.6 (Spyre) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (ROCm 6.4)
Red Hat AI Base Images 3.4.6 (ROCm 6.4) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.0.7 (TPU)
Red Hat AI Base Images 3.0.7 (TPU) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (Spyre)
Red Hat AI Base Images 3.5.5 (Spyre) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (CPU)
Red Hat AI Base Images 3.4.6 (CPU) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (CUDA 13.0)
Red Hat AI Base Images 3.5.5 (CUDA 13.0) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (CUDA 12.9)
Red Hat AI Base Images 3.5.5 (CUDA 12.9) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.0.7 (CUDA)
Red Hat AI Base Images 3.0.7 (CUDA) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (CUDA 13.0)
Red Hat AI Base Images 3.4.6 (CUDA 13.0) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (Gaudi)
Red Hat AI Base Images 3.4.6 (Gaudi) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (TPU)
Red Hat AI Base Images 3.4.6 (TPU) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.0.7 (CPU)
Red Hat AI Base Images 3.0.7 (CPU) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (Rubin)
Red Hat AI Base Images 3.5.5 (Rubin) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.0.7 (ROCm)
Red Hat AI Base Images 3.0.7 (ROCm) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (CUDA 12.9)
Red Hat AI Base Images 3.4.6 (CUDA 12.9) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (ROCm 7.1)
Red Hat AI Base Images 3.4.6 (ROCm 7.1) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (Gaudi)
Red Hat AI Base Images 3.5.5 (Gaudi) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.0.7 (Spyre)
Red Hat AI Base Images 3.0.7 (Spyre) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (CPU)
Red Hat AI Base Images 3.5.5 (CPU) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (TPU)
Red Hat AI Base Images 3.5.5 (TPU) is now available.
Red Hat Security Advisory: OpenShift Container Platform 4.19.53 bug fix and security update
Red Hat OpenShift Container Platform release 4.19.53 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red H...
Red Hat Security Advisory: OpenShift Container Platform 4.21.40 bug fix and security update
Red Hat OpenShift Container Platform release 4.21.40 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red H...
Red Hat Security Advisory: OpenShift Container Platform 4.20.44 bug fix and security update
Red Hat OpenShift Container Platform release 4.20.44 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red H...
Red Hat Security Advisory: Red Hat AI Base Images 3.4.7 (CUDA 13.0)
Red Hat AI Base Images 3.4.7 (CUDA 13.0) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.0.8 (CPU)
Red Hat AI Base Images 3.0.8 (CPU) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.0.8 (CUDA)
Red Hat AI Base Images 3.0.8 (CUDA) is now available.
Red Hat Security Advisory: Red Hat AI Base Images 3.5.6 (CUDA 12.9)
Red Hat AI Base Images 3.5.6 (CUDA 12.9) is now available.

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Important

> HISTORIQUE DES MODIFICATIONS

Première apparition
09/06/2026 17:17
Source: NVD
📊 ENRICHISSEMENT 01/07/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-416: Use After Free - The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original p...
📊 ENRICHISSEMENT 14/06/2026 05:00
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Important", "severity_scale": null }
📊 ENRICHISSEMENT 14/06/2026 05:00
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 3 Dernière mise à jour: 4 months ago

> REFERENCES

https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde...
https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d7...
https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefe...
https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e4...
https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce72...
https://openssl-library.org/news/secadv/20260609.txt
« BACK_TO_HOME